Security and Responsible Disclosure

This page states how to report a security vulnerability to RJV Technologies Ltd, the response you can expect, and the safe harbour you operate under when you report in good faith. It is our disclosure policy; the deeper description of our security architecture is on our Security & Operational Practices page.

Scope

In scope: rjvtechnologies.com and the RJV platform — the public site, the authenticated application, the APIs we publish, and the systems we operate for customers. Out of scope: third-party services we use but do not operate (report those to their operators), social engineering of our staff, and physical attacks. If you are unsure whether a system is ours, ask us before testing.

How to report

Email security@rjvtechnologies.com with: the affected system and URL, the type of issue, step-by-step reproduction, the impact you believe it has, and any proof-of-concept. Please use our PGP key if the report is sensitive; ask and we will send it. Do not report vulnerabilities through public channels, support tickets or social media.

Our commitments

Acknowledgement within 2 business days. Triage and severity assessment within 5 business days. Remediation for critical issues as fast as the fix can be built and deployed; we tell you our target and keep you informed of progress. Coordinated disclosure: we credit you when the fix is published, at your choice, and we do not pursue legal action against a researcher who stayed in scope and acted in good faith.

Safe harbour — and its limits

Good-faith research that respects this policy is authorised: we will not initiate legal action for it, and we ask our suppliers to do the same for their components. The limits: do not access, modify or exfiltrate data that is not yours (if a bug gives you access to other people's data, stop, report, and delete what you saw); do not degrade service for others; do not test at scale; do not demand payment — we do not run a bounty programme today, and if that changes we will say so on this page.